This vulnerability (CVE-2026-21015) arises from incorrect default permissions set on the FactoryCamera application in Samsung Mobile Devices before the SMR May-2026 Release 1. It allows a local attacker with low privileges to access a unique identifier on the device, potentially exposing sensitive device information. The CVSS 4.0 base score is 6.8 (medium severity), with an attack vector limited to local access, low attack complexity, no privileges required beyond limited user rights, and no user interaction needed. There is no indication of known exploits in the wild or an official patch at this time.

A local attacker with limited privileges can access a unique device identifier due to incorrect default permissions in the FactoryCamera app. This could lead to privacy concerns or device tracking but does not directly indicate further privilege escalation or remote exploitation. The impact is limited to information disclosure of a unique identifier.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to trusted users and monitor for updates from Samsung Mobile regarding this vulnerability.